Apprentice.io

The ToS permits Apprentice to collect and use 'de-identified information' derived from customer use for improving the Software, but does not explicitly state whether raw Customer Data trains AI models. The Privacy Policy does not address AI training on user data. The vague language around 'de-identified' data and lack of explicit opt-out or no-training-by-default creates moderate concern.

“[ToS] 'Apprentice has the right to collect, use and analyze any deidentified information derived from Customer's use of the Software...for Apprentice's lawful business purposes, including to improve and enhance the Software'”

The ToS grants Apprentice a broad right to use de-identified data derived from Customer Data for business purposes including service improvement, but Customer retains ownership of Customer Data itself. However, the scope of what constitutes 'de-identified' and how it may be sublicensed is unclear. The license to de-identified data is not explicitly limited to service delivery only.

“[ToS] 'Apprentice has the right to collect, use and analyze any deidentified information derived from Customer's use of the Software...Apprentice may disclose De-identified Data solely in aggregate form in connection with its business'”

The Privacy Policy states the Company will not sell or rent personally identifiable information to unaffiliated third parties without permission, but permits sharing with service providers and hosting providers. No explicit Data Processing Agreement or sub-processor list is provided in the documents. The policy mentions data may be stored with 'hosting providers' but lacks detail on DPA requirements or sub-processor controls.

“[Privacy] 'We may store personal information in locations outside the direct control of the Company (for instance, on servers or databases co-located with hosting providers)' and 'We will not rent or sell your personally identifiable information to others'”

The ToS explicitly states that 'any Customer Data in the Software will be permanently lost at the end of the Pilot Period,' indicating data is not retained after termination. However, for non-Pilot subscriptions, no retention period is specified. The Privacy Policy states 'Non-personally identifiable information may be stored indefinitely,' creating indefinite retention of de-identified data. This is unfavorable for data minimization.

“[ToS] 'any Customer Data in the Software will be permanently lost at the end of the Pilot Period' and [Privacy] 'Non-personally identifiable information may be stored indefinitely'”

The ToS explicitly states 'Customer shall retain all right, title and interest to all Customer Data and Customer Confidential Information.' Apprentice retains rights only to the Software itself and de-identified data derived from use, not to Customer Data or outputs generated by customers using the Software.

“[ToS] 'Customer shall retain all right, title and interest to all Customer Data and Customer Confidential Information. Apprentice shall retain all right, title and interest in and to (i) the Software...'”

The Privacy Policy mentions Privacy Shield Framework certification, GDPR compliance, HIPAA compliance, and references to Security Risk Register and Data Protection Impact Assessments. However, no SOC 2 Type II, ISO 27001, or other formal third-party security certifications are explicitly mentioned. The claims are stated but not independently verified or linked to published trust documentation.

“[Privacy] 'The Company has certified to the Department of Commerce that it adheres to the Privacy Shield Principles' and 'All relevant data processes and flows have been assessed as part of our Security Risk Register and meet the Data Protection Impact Assessment Requirements of the GDPR and HIPAA/HITECH'”